Lead Information Security Auditor (GRC)

CONMED Corporation • Largo, FL

4d

About The Position

The Lead Information Security Auditor (GRC) is a senior cybersecurity and risk management leader responsible for establishing, maintaining, and continuously improving the organization’s cybersecurity governance, risk, and compliance program across product development, manufacturing, operational technology, and enterprise IT environments. The role ensures the organization manages cyber risk, complies with applicable regulatory and industry requirements, and maintains governance processes that protect intellectual property, patient safety, operational resilience, and business objectives.

The position serves as a key liaison among cybersecurity, business leadership, quality and regulatory affairs, legal, audit, and external regulators. It helps embed security requirements throughout operations and the product lifecycle, supports regulatory readiness, manages enterprise cyber risk, and provides executive visibility into cybersecurity posture and compliance performance.

The role leads cybersecurity governance, enterprise risk management, regulatory compliance and audit management, third-party risk management, product security governance, security awareness and compliance initiatives, and business continuity and resilience governance. It also provides leadership for GRC initiatives, mentors cybersecurity professionals, presents updates to senior stakeholders, and supports strategic cybersecurity planning and roadmap development.

The position requires a bachelor’s degree in a relevant field or equivalent experience and at least seven years of relevant experience. Preferred qualifications include GRC program experience, familiarity with healthcare, medical device manufacturing, life sciences, or other regulated industries, knowledge of specified cybersecurity frameworks and regulations, experience with enterprise GRC platforms and executive risk reporting, and relevant professional certifications. The annual salary range is $104,134–$163,640. The posting is anticipated to close November 8, 2026. This position is not eligible for employer-visa sponsorship.

Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Business, Engineering, Risk Management, or a related field, or equivalent experience.
• At least 7 years of experience in cybersecurity, information security governance, risk management, compliance, audit, or related disciplines.

Nice To Haves

• Experience developing and managing cybersecurity governance, risk, and compliance programs.
• Experience conducting risk assessments and managing enterprise risk registers.
• Experience supporting internal audits, external audits, and regulatory examinations.
• Strong understanding of cybersecurity frameworks and regulatory requirements.
• Experience in healthcare, medical device manufacturing, life sciences, or regulated industries.
• Deep knowledge of NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and third-party risk management practices.
• Experience managing enterprise GRC platforms such as ServiceNow GRC, Archer, OneTrust, or AuditBoard.
• Experience developing executive risk reporting, metrics, and board-level presentations.
• Familiarity with medical device cybersecurity regulations and product security risk management.
• Professional certifications preferred: CISSP, CRISC, CISM, CGRC (formerly CAP), CISA, or ISO 27001 Lead Implementer or Lead Auditor.

Responsibilities

• Lead the development, implementation, and maintenance of cybersecurity policies, standards, procedures, and governance frameworks.
• Establish cybersecurity governance processes aligned with business objectives and regulatory requirements, maintaining alignment with NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and applicable industry regulations.
• Develop and present cybersecurity metrics, KPIs, KRIs, and risk dashboards to executive leadership; facilitate steering committees and governance forums; and track remediation accountability.
• Lead enterprise-wide cybersecurity risk assessments and risk management programs, including maintaining a cyber risk register covering enterprise IT, manufacturing systems, cloud services, and connected medical devices.
• Evaluate risks related to patient safety, operational resilience, intellectual property, regulatory exposure, and business continuity; assess risks for new technologies, business initiatives, mergers, acquisitions, and strategic projects.
• Develop risk treatment plans, monitor mitigation through completion, and translate technical security risks into business impact statements for executive leadership.
• Lead cybersecurity compliance efforts and coordinate internal audits, external audits, regulatory inspections, and customer security assessments.
• Manage audit evidence collection, control validation, remediation tracking, control maturity assessments, and gap analyses; partner with Internal Audit, Legal, Compliance, and Regulatory Affairs on compliance readiness.
• Oversee audit findings and corrective action plans through closure.
• Lead cybersecurity due diligence and risk assessments for vendors, suppliers, manufacturing partners, and service providers; establish third-party security requirements and contractual obligations; assess supplier posture and drive remediation or risk acceptance.
• Partner with Engineering, Product Development, Quality, and Regulatory Affairs to incorporate cybersecurity requirements throughout the product lifecycle.
• Oversee cybersecurity risk assessments for medical and surgical devices; support secure development governance and cybersecurity documentation; ensure compliance with applicable device cybersecurity guidance and regulatory expectations; and facilitate coordinated vulnerability disclosure governance and vulnerability management oversight.
• Lead enterprise cybersecurity awareness, education, and compliance initiatives; promote security accountability and risk ownership; develop targeted awareness programs; support phishing awareness, policy compliance, and training; and measure program effectiveness and compliance trends.
• Partner with business continuity and disaster recovery stakeholders to address cyber resilience requirements; support business impact analyses and resilience planning; participate in tabletop exercises and cyber crisis planning; evaluate recovery capabilities and resilience controls; and monitor resulting remediation actions.
• Provide leadership and direction for cybersecurity GRC initiatives and mentor cybersecurity professionals on risk management, compliance frameworks, and governance practices.
• Serve as the primary cybersecurity liaison for Audit, Compliance, Legal, Quality, and Regulatory Affairs; present risk and compliance updates to executive leadership, committees, and external stakeholders; and support cybersecurity planning and roadmap development.

Benefits

• Competitive compensation.
• Medical, dental, vision, and prescription coverage.
• Short- and long-term disability and life insurance, with cost paid fully by CONMED.
• Retirement Savings Plan (401K), with dollar-for-dollar matching and the potential for up to 7% per pay period.
• Employee Stock Purchase Plan with discounted stock purchases.
• Tuition assistance for undergraduate and graduate-level courses.
• Employee Referral Program incentives.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior